Multi-int maritime threat detection

ABSTRACT

A system for detecting threats using an overt threat detector, the system includes a computer-readable memory configured to store computer executable instructions; a processor configured to execute the computer executable instructions, the computer executable instructions comprising receiving historical data regarding vessel patterns in a geographic area; generating, using a computer processor, at least one overt threat model based on the received historical data; receiving tracking data of vessels currently in the geographic area; analyzing, using the computer processor, the tracking data of vessels using the at least one overt threat model; and modifying, using the computer processor, the tracking data of vessels based on the results of the analyzing step; and an output device configured to output the modified tracking data of vessels is disclosed.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a divisional application of U.S. Pat. ApplicationSerial No. 15/254,560 filed on Sep. 1, 2016, which is herebyincorporated herein by reference in its entirety.

TECHNICAL FIELD

This disclosure is generally related to detecting threats posed byadversaries. In particular, this disclosure is directed to detectingswarming attacks posed by maritime adversaries.

BACKGROUND

In naval operations, such as military operations conducted by the UnitedStates Navy and commercial operations conducted by a variety ofcompanies, there is frequently a threat of attack. For example,terrorists and pirates may engage in asymmetric warfare. Asymmetricwarfare may include attempts to overwhelm a target ship or battle groupwith a greater number of attack vessels; there may be one target shipthat is swarmed by a greater number, such as ten, attack vessels. Theattack vessels are each independent targets for the target ship toneutralize. Because there may be many attack vessels, it may bedifficult for the target ship to neutralize all of the attack vesselsbefore the attack vessels inflict damage. Therefore, a system to detectsuch attacks earlier may result in saved lives. However, no automatedsystem exists to detect and warn the target ship that such an attack maybe underway. Currently, one or more human operators, generally radaroperators, examine radar screens to determine which of the detectedvessels may be engaged in an attack.

Accordingly, there is a need for an automated system to detectasymmetric maritime attacks in advance of the attacks actuallyoccurring.

SUMMARY

In one aspect of this disclosure, a method for detecting threats usingan overt threat detector, the method comprising receiving historicaldata regarding vessel patterns in a geographic area; generating, using acomputer processor, at least one overt threat model based on thereceived historical data; receiving tracking data of vessels currentlyin the geographic area; analyzing, using the computer processor, thetracking data of vessels using the at least one overt threat model;modifying, using the computer processor, the tracking data of vesselsbased on the results of the analyzing step; and outputting, using thecomputer processor, the modified tracking data of vessels.is disclosed.

In another aspect of this disclosure, a method for detecting threatsusing a pattern of activity, the method comprising receiving historicaldata regarding vessel patterns in a geographic area; generating, using acomputer processor, at least one pattern of activity distribution basedon the received historical data; receiving tracking data of vesselscurrently in the geographic area; analyzing, using the computerprocessor, the tracking data of vessels using the at least one patternof activity distribution; modifying, using the computer processor, thetracking data of vessels based on results of the analyzing step; andoutputting, using the computer processor, the modified tracking data ofvessels is disclosed.

In another aspect of this disclosure, a method for detecting threatsusing signal intelligence (“sig-int”), the method comprising receivingtracking data of vessels currently in a geographic area; receivingsig-int data originating in the geographic area; generating, using acomputer processor, an error ellipse based on the sig-int data;analyzing, using the computer processor, the tracking data using theerror ellipse; modifying, using the computer processor, the trackingdata based on the results of the analyzing step; and outputting, usingthe computer processor, the modified tracking data of vessels isdisclosed.

In another aspect of this disclosure, a system for detecting threatsusing an overt threat detector, the system comprising acomputer-readable memory configured to store computer executableinstructions; a processor configured to execute the computer executableinstructions, the computer executable instructions comprising receivinghistorical data regarding vessel patterns in a geographic area;generating, using a computer processor, at least one overt threat modelbased on the received historical data; receiving tracking data ofvessels currently in the geographic area; analyzing, using the computerprocessor, the tracking data of vessels using the at least one overtthreat model; and modifying, using the computer processor, the trackingdata of vessels based on the results of the analyzing step; and anoutput device configured to output the modified tracking data of vesselsis disclosed.

In another aspect of this disclosure, a system for detecting threatsusing a pattern of activity, the system comprising a computer-readablememory configured to store computer executable instructions; a processorconfigured to execute the computer executable instructions, the computerexecutable instructions comprising receiving historical data regardingvessel patterns in a geographic area; generating, using a computerprocessor, at least one pattern of activity distribution based on thereceived historical data; receiving tracking data of vessels currentlyin the geographic area; analyzing, using the computer processor, thetracking data of vessels using the at least one pattern of activitydistribution; and modifying, using the computer processor, the trackingdata of vessels based on results of the analyzing step; and an outputdevice configured to output the modified tracking data of vessels isdisclosed.

In another aspect of this disclosure, a system for detecting threatsusing a pattern of activity, the system comprising a computer-readablememory configured to store computer executable instructions; a processorconfigured to execute the computer executable instructions, the computerexecutable instructions comprising receiving historical data regardingvessel patterns in a geographic area; generating, using a computerprocessor, at least one pattern of activity distribution based on thereceived historical data; receiving tracking data of vessels currentlyin the geographic area; analyzing, using the computer processor, thetracking data of vessels using the at least one pattern of activitydistribution; and modifying, using the computer processor, the trackingdata of vessels based on results of the analyzing step; and an outputdevice configured to output the modified tracking data of vessels isdisclosed.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 shows three channels of a multi-int maritime threat detectionsystem, according to one aspect of this disclosure.

FIG. 2 shows the overt threat behavior channel, according to one aspectof this disclosure.

FIG. 3 shows the pattern of activity channel, according to one aspect ofthis disclosure.

FIG. 4 shows modules to carry out the pattern of activity channel,according to one aspect of this disclosure.

FIG. 5 shows the signals intelligence (“sig-int”) channel, according toone aspect of this disclosure.

FIG. 6 is a flowchart showing a method of execution of the overt threatbehavior channel, according to one aspect of this disclosure.

FIG. 7 is a flowchart showing a method of execution of the pattern ofactivity channel, according to one aspect of this disclosure.

FIG. 8 is a flowchart showing a method of execution of the sig-intchannel, according to one aspect of this disclosure.

FIG. 9 is a block diagram of the multi-int maritime threat detectionsystem, according to one aspect of this disclosure.

DETAILED DESCRIPTION

It is to be understood that the figures and descriptions of the presentdisclosure may have been simplified to illustrate elements that arerelevant for a clear understanding of the present disclosure, whileeliminating, for purposes of clarity, other elements found in a typicalnetworking system or method. Those of ordinary skill in the art willrecognize that other elements may be desirable and/or required in orderto implement the present disclosure. However, because such elements arewell known in the art, and because they do not facilitate a betterunderstanding of the present disclosure, a discussion of such elementsis not provided herein. It is also to be understood that the figuresincluded herewith only provide diagrammatic representations of thepresently preferred structures of the present disclosure and thatstructures falling within the scope of the present disclosure mayinclude structures different than those shown in the drawings.

Broadly, this disclosure discloses systems and methods for detectingmaritime threats. In one aspect of this disclosure, three channels maybe used to detect maritime threats: an overt threat behavior channel, apattern of activity channel, and a signal intelligence channel. One ofordinary skill in the art would readily recognize that the systems andmethods disclosed herein may use any combination of the channels todetect maritime threats, including using only one channel. In one aspectof this disclosure, the overt threat behavior channel may generatemodels that model potentially threatening behavior. The systems andmethods may then analyze the current positioning and movement of vesselswithin a geographic area using the models to determine whether any ofthe vessels pose a threat. In another aspect of this disclosure, thepattern of activity channel may generate models that model historicalvessel behavior. The systems and methods may then analyze the currentbehavior of vessels within the geographic area using the models todetermine whether any of the vessels pose a threat. In another aspect ofthis disclosure, the signal intelligence channel may gather signals fromvessels in a geographic area. The signal intelligence channel may thengenerate an error ellipse denoting an area within the geographic areathat the signal is most likely to originate. The systems and methods maythen increase a threat level of any vessels located within the errorellipse.

FIG. 1 shows three channels of a multi-int maritime threat detectionsystem 100, according to one aspect of this disclosure. The multi-intmaritime threat detection system 100 may include an overt threatbehavior channel 104, a pattern of activity channel 106, and asignificant intelligence (“sig-int”) channel 108. One of ordinary skillin the art would readily recognize that any number of channels may beused in the multi-int maritime threat detection system 100. Each of thethree channels 104, 106, 108 may receive as an input tracks 102 of othermaritime vessels. The tracks 102 may be detected using any suitabledetection mechanism, such as radar, lidar, video cameras,electro-optical sensors (“EO”), infrared (“IR”) sensors, andcommunication interception equipment. The multi-int maritime threatdetection system 100 may detect any number of tracks 102. For example,in FIG. 1 , the multi-int maritime threat detection system 100 hasdetected nine tracks. The three channels 104, 106, 108 may process thetracks 102 and output a graphic. The graphic may vary depending on thechannel producing the graphic. For example, the overt threat behaviorchannel 104 may output graphic 110, the pattern of activity channel 106may output graphic 112, and the sig-int channel may output graphic 114.Based on these graphics, the multi-int maritime threat detection system100 may output a result 116. For example, the result may include a trackthreat assessment, real-time indications, and audio and/or visualwarnings for each analyzed track 102. The multi-int maritime threatdetection system 100 may use any number of channels to output a result116. For example, in some aspects of this disclosure, the multi-intmaritime threat detection system 100 may use only the overt threatbehavior channel 104. In other aspects, the multi-int maritime threatdetection system 100 may use all three channels 104, 106, 108 to outputthe result 116. The overt threat behavior channel 104, the pattern ofactivity channel 106, and the sig-int channel 108 are described infurther detail below.

FIG. 2 shows the overt threat behavior channel 104, according to oneaspect of this disclosure. In one aspect, nine tracks 103 are detected.The nine tracks 103 may represent a boat, a ship, a buoy, or any othermaritime vessel. The nine tracks 103 may be detected using any suitableequipment, as described above in reference to FIG. 1 . The nine tracks103 may then be input into the overt threat behavior channel 104 foranalysis to determine if any of the nine tracks 103 present a threat. Inone aspect of this disclosure, the overt threat behavior channel 104 mayutilize various models of expected behaviors. In FIG. 2 , three modelsof expected behaviors 202, 204, 206 are shown. One of ordinary skill inthe art would readily recognize that any number of models of expectedbehaviors may be used in the overt threat behavior channel 104. Thevarious models of expected behaviors may model threatening behavior.

The models of expected behaviors may be based on, for example, knownformations or maneuvers of maritime vessels or any other informationuseful for predicting maritime threats. For example, model of expectedbehavior 202 may model various maritime vessels forming a swarm. Modelof expected behavior 204 may model a maritime formation other than aswarm. Model of expected behavior 206 may model synchronized maritimevessels, such as the maritime vessels turning together or headingtowards a protected asset. Alternatively, or additionally, amathematical formula may be generated to model threatening behavior. Themathematical formula may be generated so that it is more flexible orrobust. For example, a formation of maritime vessels may represent anelevated threat. However, if the mathematical formula is not flexible,one maritime vessel dropping out of the formation may result in themulti-int maritime threat detection system 100 failing to recognize anelevated threat because one of the maritime vessels dropped out of theformation. Therefore, the multi-int maritime threat detection system 100may be more robust if mathematical formulas underlying the models aremore flexible. One of ordinary skill in the art would readily recognizethat any other suitable models for modelling threatening behavior may beused. Whichever method is used to generate the models 202, 204, 206, themodels 202, 204, 206 may be tested against innocent maritime traffic toensure that false alarm rates are acceptable. The innocent maritimetraffic may be provided by maritime traffic monitors. For example, inthe Los Angeles harbor, MAREX is a group that monitors marine traffic inthe Los Angeles harbor using, for example, radars. If the false alarmrates for a given model are sufficiently low, the given model may beused in the overt threat behavior channel 104.

The three models 202, 204, 206 may provide a baseline for threateningbehavior. The overt threat behavior channel 104 may compare the tracks102 to the models 202, 204, 206. If the overt threat behavior channel104 determines that any of the tracks 102 correspond to threateningbehavior as identified by the models 202, 204, 206, then the overtthreat behavior channel 104 may output a result 116 that a risk of athreat is elevated. For example, the overt threat behavior channel 104may determine that at least one of the tracks 102 correspond tothreatening behavior as identified by the models 202, 204, 206 if thereis an exact match. However, the overt threat behavior channel 104 maydetermine there is a correspondence even if there is not an exact match.For example, if the correspondence is represented as a percentage, thenthe overt threat behavior channel 104 may determine that there is acorrespondence if a certain minimum percentage is reached, such as 85%.Moreover, the overt threat behavior channel 104 may graphically displaywhich of the tracks 102 pose an elevated threat. For example, graphic110 shows the tracks 102. In one aspect, the tracks 102 may bedistinguished into two groups. A first group 208 may represent tracksthat do not pose a threat. A second group 210 may represent tracks thatdo pose a threat. Accordingly, a user of the multi-int maritime threatdetection system 100 may visually inspect which tracks are threateningand the proximity of the threatening tracks to the defended asset.

In addition to recognizing increased threats based on the models 202,204, 206, the overt threat behavior channel 104 may determine when amaritime vessel would intersect with the defended asset. For example,the overt threat behavior channel 104 may determine that one of thetracks 102 is on a path to intersect the defended asset at a certainlocation and at a certain time. The overt threat behavior channel 104may determine the location and time based on the direction the track istravelling and the speed at which it is travelling. The overt threatbehavior channel may extrapolate this direction and speed data todetermine when the track would intersect with the defended asset. Theovert threat behavior channel 104 may provide a warning for such anoccurrence.

FIG. 3 shows the pattern of activity channel 106, according to oneaspect of this disclosure. The tracks 102 may be used as an input to thepattern of activity channel 106. For example, like FIG. 2 , there may benine tracks. The pattern of activity channel 106 may use the tracks 102to generate a statistical distribution of normal traffic. For example,the pattern of activity channel 106 may generate a statisticaldistribution based on the location, the time of day, the day of theweek, etc. For example, in the Los Angeles harbor, MAREX is a group thatmonitors marine traffic in the Los Angeles harbor using, for example,radars. The information gathered and provided by MAREX may serve as thetracks 102. Using the MAREX data, the pattern of activity channel 106may generate a traffic statistical distribution. One of ordinary skillin the art would readily recognize that data gathered from any source,not just MAREX or organizations similar to MAREX, may be utilized by thepattern of activity channel 106. The pattern of activity channel 106 maythen use the statistical distribution as a comparison for new vessels.For example, the multi-int maritime threat detection system 100 maycompare detected traffic against the statistical distribution and outputthe graphic 112, which may show detected traffic that is inconsistentwith the statistical distribution.

FIG. 4 shows modules to carry out the pattern of activity channel 106,according to one aspect of this disclosure. The tracks 102 that mayserve as inputs to the pattern of activity channel 102 may be the MAREXmaritime traffic distribution 400A as described above with reference toFIG. 3 . The tracks 102 may also be radar tracks associated withdetected vessels 400B. The MAREX maritime traffic distribution 400A andthe radar tracks associated with detected vessels 400B may be input intorespective trackers 402A, 402B. The trackers 402A, 402B may outputtracking data associated with the MAREX maritime traffic distribution400A and the radar tracks associated with detected vessels 400B, whichmay serve as inputs to respective track conditioning modules 404A, 404B.The output of track conditioning 404A may then be used to generate thestatistical distribution as described above with reference to FIG. 3 .For example, FIG. 4 shows two statistical distributions. The firststatistical distribution may be a combined speed and headingdistribution 406. The combined speed and heading distribution 406 mayindicate historical speed and heading distributions. The secondstatistical distribution may be a combined traffic density and spacingdistribution 408. The combined traffic density and spacing distribution408 may indicate historical traffic density and spacing distributions.One of ordinary skill in the art would readily recognize that anysuitable statistical distribution may be generated based on the MAREXmaritime traffic distribution 400A. Also, one of ordinary skill in theart would also readily recognize that any number and/or any combinationof statistical distributions may be generated.

The pattern of activity channel 106 may then compare the output of trackconditioning module 404B with the combined speed and headingdistribution and the combined traffic density and spacing distribution408 in module 410. Module 410 may test for consistency. For example, thepattern of activity channel 106 may test for how many vessels arenormally in the area, based on the combined speed and headingdistribution 406 or the combined traffic density and spacingdistribution 408. The pattern of activity channel 106 may also test forconsistency for vessel spacing or distribution. For example, thecombined traffic density and spacing distribution 408 may indicate thatnormally there are five vessels in the area. However, if there is agreater or lesser number than five vessels in the area, for example,there are twenty vessels in the area, the pattern of activity channel106 may indicate that there is unusual activity in the area. Anotherexample is that if the detected vessels are closer than normal as shownin the distributions 406, 408, the pattern of activity channel 106 mayindicate that there is unusual activity in the area.

Results from the consistency test module 410 may be input into aBayesian Belief Network module 412. The Bayesian Belief Network module412 may serve as a damper to the pattern of activity channel 106. TheBayesian Belief Network module 412 may be used to more accuratelydetermine whether the detected tracks 400B are consistent with thestatistical distributions 406, 408. For example, the Bayesian BeliefNetwork module 412 may be used to determine whether the detected tracks400B are more likely to be consistent with the statistical distributions406, 408 or that they are more likely to be anomalous.

The output of the Bayesian Belief Network module 412 may then be outputon a display. For example, the display may display output graphic 112.Output graphic 112 may visually indicate which vessel or vessels exhibitanomalous behavior. For example, the vessel or vessels exhibitinganomalous behavior may be shown in, for example, red while the vessel orvessels consistent with the statistical distributions 406, 408 may beshown in, for example, green. One of ordinary skill in the art wouldreadily recognize that any color or combination of colors may be used inthe output graphic 112 to indicate anomalous or consistent behavior.

FIG. 5 shows the significant intelligence (“sig-int”) channel 108,according to one aspect of this disclosure. For example, the nine tracks103 described above may be used as inputs to the sig-int channel 108.The nine tracks 103 may be input as the tracks 102. The sig-int channel108 may also gather sig-int data 502. Sig-int data 502 may include anysuitable type and source of data. For example, the sig-int data 502 mayinclude an intercepted cell phone message. Sig-int data 502 may alsoinclude other electronic indications such as indications that a certainvessel may be used to carry out the attack. Any suitable mechanism maybe used to gather the sig-int data 502. In one aspect of thisdisclosure, an aircraft, such as a helicopter, may be used to collectthe sig-int data 502 using any suitable mechanism. It may often bedifficult to obtain a precise location of where the sig-int data 502 isoriginating from. If an aircraft is being used to gather the sig-intdata 502, the aircraft may changes positions. The mechanism used tocollect the sig-int data 502 may then analyze how the direct of thesource of the sig-int data 502 changes based on the various aircraftpositions to obtain a more precise location of the sig-int data 502.Collecting sig-int data 502 from various positions may then result in anerror ellipse. The error ellipse may represent an area that contains themost likely location of the sig-int data 502. A size of the errorellipse may depend on the amount of sig-int data 502 collected and anumber of locations of the aircraft where the sig-int data 502 iscollected.

After an error ellipse is generated, the sig-int channel 108 mayindicate that vessels within the error ellipse are more likely to bedangerous. For example, in one aspect of this disclosure, detectedvessels may have an associated threat score. Detected vessels locatedwithin the error ellipse may have a slightly increased threat score.

FIG. 6 is a flowchart showing a method 600 of execution of the overtthreat behavior channel 104, according to one aspect of this disclosure.The method may begin at block 602. At block 602, the overt threatbehavior channel 104 may receive as an input historical data regardingvessel patterns in a geographic area. After the overt threat behaviorchannel 104 receives the historical data regarding vessel patterns in ageographic area, the method 600 may proceed to block 604.

At block 604, the overt threat behavior channel 104 may generate overtthreat models based on the historical data regarding vessel patterns ina geographic area. For example, the overt threat models generated inblock 604 may be the three models of expected behaviors 202, 204, 206 asdescribed above. After block 604 is completed, the method 600 mayproceed to block 606.

At block 606, the overt threat behavior channel 104 may receive as aninput at least one track 102 of a vessel. The at least one track 102 maybe detected using any suitable hardware and software, including radarand/or images. After block 606 is complete, the method 600 may proceedto block 608.

At block 608, the overt threat behavior channel 104 may analyze the atleast one input track 102 received in block 606 using the overt threatmodels generated in block 604. The analysis may be similar to theanalysis described above with reference to FIG. 2 . After block 608 iscomplete, the method 600 may proceed to block 610.

At block 610, the overt threat behavior channel 104 may modify the atleast one input track received in block 606 based on the analysiscompleted in block 610. For example, if the overt threat behaviorchannel 104 determines that a vessel, based on the analysis completed inblock 608, poses an overt threat, the overt threat behavior channel 104may modify the track for that vessel to indicate that the vessel posesan overt threat. For example, the overt threat behavior channel 104 maychange the color, shape, or size of the track of the vessel. One ofordinary skill in the art would readily recognize that othermodifications may also be performed. After block 610 is complete, themethod 600 may proceed to block 612.

At block 612, the overt threat behavior channel 104 may display theanalyzed tracks. For example, the overt threat behavior channel 104 mayoutput results of the analysis and modifications in block 608 and 610 ina graphical form, such as output graphic 110. As shown in FIG. 1 ,output graphic 110 may show a first group 208 that does not pose athreat and a second group 210 that does pose a threat. After block 612is complete, the method 600 may proceed to block 614.

At block 614, the overt threat behavior channel 104 may issue an alertif warranted. An alert may be warranted if the overt threat behaviorchannel 104 determines that there is at least one potential threat, forexample, in blocks 608 and 610. The alert may be, for example,graphical, such as a warning on output graphic 110, or the alert may beaudible, such as an audible alarm. After block 614 is complete, themethod 600 may end.

FIG. 7 is a flowchart showing a method 700 of execution of the patternof activity channel 106, according to one aspect of this disclosure. Themethod 700 may begin at block 702. At block 702, the pattern of activitychannel 106 may receive as an input historical data regarding vesselpatterns in a geographic area. After the pattern of activity channel 106receives the historical data regarding vessel patterns in a geographicarea, the method 700 may proceed to block 704.

At block 704, the pattern of activity channel 106 may generate at leastone pattern of activity distribution based on the historical dataregarding vessel patterns in a geographic area received in block 702.For example, the pattern of activity channel 106 may generate thecombined speed and heading distribution 406 and the combined trafficdensity and spacing distribution 408 as described above. One of ordinaryskill in the art would readily recognize that other pattern of activitydistributions may be generated based on the historical data received inblock 702. After block 704 is complete, the method 700 may proceed toblock 706.

At block 706, the pattern of activity channel 106 may receive as aninput at least one track 102 of a vessel. The at least one track 102 maybe detected using any suitable hardware and software, including radarand/or images. After block 706 is complete, the method 700 may proceedto block 708.

At block 708, the pattern of activity channel 106 may analyze thereceived vessel track 102 from block 706 for consistency with thepattern of activity distributions generated in block 704, as describedabove. After block 708 is complete, the method 700 may proceed to block710.

At block 710, the pattern of activity channel 106 may modify theanalyzed input track to highlight potential threats, as described abovewith reference to FIGS. 3 and 4 . After block 710 is complete, themethod 700 may proceed to block 712.

At block 712, the pattern of activity channel 106 may display theanalyzed tracks. For example, the pattern of activity channel 106 mayoutput results of the analysis and modifications in blocks 708 and 710in a graphical form, such as output graphic 112. As shown in FIG. 3 ,output graphic 112 may show a first group 302 that does not pose athreat and a second group 304 that does pose a threat. After block 712is complete, the method 700 may proceed to block 714.

At block 714, the pattern of activity channel 106 may issue an alert ifwarranted. An alert may be warranted if the pattern of activity channel106 determines that there is at least one potential threat, for example,in blocks 708 and 710. The alert may be, for example, graphical, such asa warning on output graphic 112, or the alert may be audible, such as anaudible alarm. After block 714 is complete, the method 700 may end.

FIG. 8 is a flowchart showing a method 800 of execution of the sig-intchannel 108, according to one aspect of this disclosure. The method 800may begin at block 802. At block 802, the sig-int channel 108 mayreceive as an input historical data regarding vessel patterns in ageographic area. After the sig-int channel 108 receives the historicaldata regarding vessel patterns in a geographic area, the method 800 mayproceed to block 804.

At block 804, the sig-int channel 108 may receive sig-int data 502collected as described above with reference to FIG. 5 . After block 804is complete, the method 800 may proceed to block 806.

At block 806, the sig-int channel 108 may generate an error ellipse, asdescribed above with reference to FIG. 5 , based on the sig-int data 502received in block 804. After block 804 is complete, the method 800 mayproceed to block 808.

At block 808, the sig-int channel 108 may analyze the received track inblock 802 using the error ellipse generated in block 806 as describedabove. After block 808 is complete, the method 800 may proceed to block810.

At block 810, the sig-int channel 108 may modify the received vesseltrack to highlight potential threats, as described above with referenceto FIG. 5 . After block 810 is complete, the method 800 may proceed toblock 812.

At block 812, the sig-int channel 108 display the analyzed tracks. Forexample, the sig-int channel 108 may output results of the analysis andmodifications in blocks 808 and 810 in a graphical form, such as outputgraphic 114. As shown in FIG. 5 , output graphic 114 may show a firstgroup 506 that does not pose a threat and a second group 508 that doespose a threat. After block 812 is complete, the method 800 may proceedto block 814.

At block 814, the sig-int channel 108 may issue an alert if warranted.An alert may be warranted if the sig-int channel 108 determines thatthere is at least one potential threat, for example, in blocks 808 and810. The alert may be, for example, graphical, such as a warning onoutput graphic 114, or the alert may be audible, such as an audiblealarm. After block 814 is complete, the method 800 may end.

FIG. 9 is a block diagram 900 of the multi-int maritime threat detectionsystem 100, according to one aspect of this disclosure. A server 900, orother computer system similarly configured, may include and executeprograms to perform functions described herein, including steps ofmethod described above. While only one processor 914 is shown in FIG. 9, it is understood that server 900, or other computing systems used toimplement the renewable energy network optimization tool may includemultiple processors. Additionally, a system for implementing therenewable energy network optimization tool may include multiplenetworked servers 900 or other computing systems. Further, a mobiledevice that includes some of the same components of computer system 900may perform steps of the method described above. Computer system 900 mayconnect with a network 918, e.g., Internet, or other network, to receiveinquires, obtain data, and transmit information (e.g., to a user workstation or other user computing device) as described above.

Computer system 900 typically includes a memory 902, a secondary storagedevice 912, and a processor 914. Computer system 900 may also include aplurality of processors 914 and be configured as a plurality of, e.g.,bladed servers, or other known server configurations. Computer system900 may also include an input device 916, a display device 910, and anoutput device 908.

Memory 902 may include RAM or similar types of memory, and it may storeone or more applications for execution by processor 914. Secondarystorage device 912 may include a hard disk drive, floppy disk drive,CD-ROM drive, or other types of non-volatile data storage. Processor 914may include multiple processors or include one or more multi-coreprocessors. Any type of processor 914 capable of performing thecalculations described herein may be used. Processor 914 may execute theapplication(s) that are stored in memory 902 or secondary storage 912,or received from the Internet or other network 918. The processing byprocessor 914 may be implemented in software, such as software modules,for execution by computers or other machines. These applicationspreferably include instructions executable to perform the functions andmethods described above and illustrated in the Figures herein. Theapplications may provide graphic user interfaces (GUIs) through whichusers may view and interact with the application(s).

Also, as noted, processor 914 may execute one or more softwareapplications in order to provide the functions described in thisspecification, specifically to execute and perform the steps andfunctions in the methods described above. Such methods and theprocessing may be implemented in software, such as software modules, forexecution by computers or other machines.

Input device 916 may include any device for entering information intocomputer system 900, such as a touch-screen, keyboard, mouse,cursor-control device, microphone, digital camera, video recorder orcamcorder. Input device 916 may be used to enter information into GUIsduring performance of the methods described above. Display device 910may include any type of device for presenting visual information suchas, for example, a computer monitor or flat-screen display (or mobiledevice screen). Output device 908 may include any type of device forpresenting a hard copy of information, such as a printer, and othertypes of output devices include speakers or any device for providinginformation in audio form.

Examples of computer system 900 include dedicated server computers, suchas bladed servers, personal computers, laptop computers, notebookcomputers, palm top computers, network computers, mobile devices, or anyprocessor-controlled device capable of executing a web browser or othertype of application for interacting with the system. If computer system900 is a server, server 900 may not include input device 916, displaydevice 910 and output device 908. Rather, server 900 may be connected,e.g., through a network connection to a stand-alone work station(another computer system) that has such devices.

Although only one computer system 900 is shown in detail, the system forproviding a renewable energy network optimization tool may use multiplecomputer systems or servers as necessary or desired to support theusers, as described above. Embodiments may also use backup or redundantservers to prevent network downtime in the event of a failure of aparticular server. In addition, although computer system 900 is depictedwith various components, one skilled in the art will appreciate that theserver can contain additional or different components. In addition,although aspects of an implementation consistent with the above aredescribed as being stored in memory, one skilled in the art willappreciate that these aspects can also be stored on or read from othertypes of computer program products or computer-readable media, such assecondary storage devices, including hard disks, floppy disks, orCD-ROM; or other forms of RAM or ROM. Computer-readable media mayinclude instructions for controlling a computer system, such as thecomputer system 900, to perform a particular method, such as methodsdescribed above.

The terms and descriptions used herein are set forth by way ofillustration only and are not meant as limitations. Those skilled in theart will recognize that many variations are possible within the spiritand scope of the invention as defined in the following claims, and theirequivalents, in which all terms are to be understood in their broadestpossible sense unless otherwise indicated.

What is claimed is:
 1. A method for detecting threats using signalintelligence (“sig-int”), the method comprising: receiving tracking dataof vessels currently in a geographic area; receiving, from a collector,sig-int data originating in the geographic area; generating, using acomputer processor, an error ellipse based on the sig-int data collectedat various positions of the collector; analyzing, using the computerprocessor, the tracking data using the error ellipse; modifying, usingthe computer processor, the tracking data based on the results of theanalyzing step; and outputting, using the computer processor, themodified tracking data of vessels.
 2. The method of claim 1, wherein thetracking data of vessels currently in the geographic area is collectedby radar.
 3. The method of claim 1, wherein the modifying step furthercomprises changing a portion of the tracking data from a first color toa second color.
 4. The method of claim 1, wherein the outputting stepfurther comprises displaying the modified tracking data of vessels on adisplay.
 5. The method of claim 4, wherein the display further displaysa warning about potential threats.
 6. The method of claim 1, wherein thesig-int data is collected by an aircraft.
 7. The method of claim 6,wherein a position of the aircraft is changing while collecting thesig-int data.
 8. The method of claim 1, wherein the error ellipsedenotes an area within the geographic area that contains a source of thesig-int data.
 9. A system for detecting threats using signalintelligence (“sig-int”), the system comprising: a computer-readablememory configured to store computer executable instructions; a processorconfigured to execute the computer executable instructions, the computerexecutable instructions comprising: receiving tracking data of vesselscurrently in a geographic area; receiving, from a collector, sig-intdata originating in the geographic area; generating, using a computerprocessor, an error ellipse based on the sig-int data collected atvarious positions of the collector; analyzing, using the computerprocessor, the tracking data using the error ellipse; and modifying,using the computer processor, the tracking data based on the results ofthe analyzing step; and an output device configured to output themodified tracking data of vessels.
 10. The method of claim 9, whereinthe tracking data of vessels currently in the geographic area iscollected by radar.
 11. The method of claim 9, wherein the modifyingfurther comprises changing a portion of the tracking data from a firstcolor to a second color.
 12. The method of claim 9, wherein the outputdevice further comprises a display configured to display the modifiedtracking data of vessels on a display.
 13. The method of claim 12,wherein the display further displays a warning about potential threats.14. The method of claim 9, wherein the sig-int data is collected by anaircraft.
 15. The method of claim 14, wherein a position of the aircraftis changing while collecting the sig-int data.
 16. The method of claim9, wherein the error ellipse denotes an area within the geographic areathat contains a source of the sig-int data.